I've almost finished committing fixes for bug 662 to the 2.0 branch. That's the one with DBI calls using interpolation instead of placeholders, which is a common way for user input SQL insertion attacks. I think it's a blocker, but Paul hasn't agreed. Can these fixes be copied to HEAD/2.1, please? I'm assuming that the updater scripts are never run from the web and leaving them alone for now. Is that correct? Three comments from the last round of fixes: 1. The same code repeated lots is probably an indication that something isn't right; 2. Helpers like counters of array length can often be done another clearer way; 3. dbh->quote() is very rarely needed. Finally, sorry if I broke anything. Since the first problems, I'm checking with perl -c as much as possible, but it's not all been tested in place yet. -- MJR/slef My Opinion Only and possibly not of any group I know. Please http://remember.to/edit_messages on lists to be sure I read http://mjr.towers.org.uk/ gopher://g.towers.org.uk/ slef@jabber.at Creative copyleft computing services via http://www.ttllp.co.uk/
On Thu, Jan 08, 2004 at 05:49:46PM +0000, MJ Ray said:
I've almost finished committing fixes for bug 662 to the 2.0 branch. That's the one with DBI calls using interpolation instead of placeholders, which is a common way for user input SQL insertion attacks. I think it's a blocker, but Paul hasn't agreed. Can these fixes be copied to HEAD/2.1, please?
Will do
I'm assuming that the updater scripts are never run from the web and leaving them alone for now. Is that correct?
Yep, thats a fair call
Three comments from the last round of fixes: 1. The same code repeated lots is probably an indication that something isn't right; 2. Helpers like counters of array length can often be done another clearer way; 3. dbh->quote() is very rarely needed.
All true
Finally, sorry if I broke anything. Since the first problems, I'm checking with perl -c as much as possible, but it's not all been tested in place yet.
No problem, things break during development, thats a given :) Thanks heaps for all your hard work on this, its really appreciated. Chris -- Chris Cormack Programmer 027 4500 789 Katipo Communications Ltd chris@katipo.co.nz www.katipo.co.nz
MJ Ray a écrit :
Finally, sorry if I broke anything. Since the first problems, I'm checking with perl -c as much as possible, but it's not all been tested in place yet.
You broke something in processz3950queue, and I loose 2hours understanding that. But that's always better than releasing a non-working z3950 client daemon that create z3950 call every 5 seconds ! (that would annoy z3950server admin !!!) Thank you for this boring stuff, anyway. I'm waiting for french translated file, that should be done soon. Then I'll integrate it, then release 2.0.0RC2. -- Paul POULAIN Consultant indépendant en logiciels libres responsable francophone de koha (SIGB libre http://www.koha-fr.org)
On 2004-01-09 07:42:47 +0000 paul POULAIN <paul.poulain@free.fr> wrote:
You broke something in processz3950queue, [...]
Ow. What? I don't see any change to it in CVS. I did have problem with one file that used C4/Acquisitions.pm, which I didn't find. I think it was z-related. -- MJR/slef My Opinion Only and possibly not of any group I know. Please http://remember.to/edit_messages on lists to be sure I read http://mjr.towers.org.uk/ gopher://g.towers.org.uk/ slef@jabber.at Creative copyleft computing services via http://www.ttllp.co.uk/
MJ Ray a écrit :
On 2004-01-09 07:42:47 +0000 paul POULAIN <paul.poulain@free.fr> wrote:
You broke something in processz3950queue, [...]
Ow. What? I don't see any change to it in CVS. I did have problem with one file that used C4/Acquisitions.pm, which I didn't find. I think it was z-related.
I saw it yesterday. I'm working on processz3950queue to improve it (& document...). I'll commit today, probably -- Paul POULAIN Consultant indépendant en logiciels libres responsable francophone de koha (SIGB libre http://www.koha-fr.org)
participants (3)
-
Chris Cormack -
MJ Ray -
paul POULAIN